STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Managed Instance must generate audit records when concurrent logons/connections by the same user from different workstations occur.

DISA Rule

SV-276262r1149695_rule

Vulnerability Number

V-276262

Group Title

SRG-APP-000506-DB-000353

Rule Version

MSQL-00-015200

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

10

Fix Recommendation

Deploy an Azure SQL Managed Instance audit. Refer to the supplemental file "AzureSQLMIAudit.sql" script.

Reference: https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/auditing-configure?view=azuresql-mi

Check Contents

Review Azure SQL Managed Instance configuration to verify that audit records are produced when concurrent logons/connections by the same user from different workstations occur.

To determine if an audit is configured, execute the following script:

SELECT name AS 'Audit Name',
status_desc AS 'Audit Status',
audit_file_path AS 'Current Audit File'
FROM sys.dm_server_audit_status
If no records are returned, this is a finding.

Run this TSQL command to determine if SQL Auditing AuditActionGroups are configured:

SELECT DISTINCT sd.audit_action_name
FROM sys.server_audit_specification_details sd
JOIN sys.server_audit_specifications s
ON s.server_specification_id = sd.server_specification_id
WHERE s.is_state_enabled = 1
AND sd.audit_action_name = 'SUCCESSFUL_LOGIN_GROUP'

If no values exist for AuditActionGroup, this is a finding.

Vulnerability Number

V-276262

Documentable

False

Rule Version

MSQL-00-015200

Severity Override Guidance

Review Azure SQL Managed Instance configuration to verify that audit records are produced when concurrent logons/connections by the same user from different workstations occur.

To determine if an audit is configured, execute the following script:

SELECT name AS 'Audit Name',
status_desc AS 'Audit Status',
audit_file_path AS 'Current Audit File'
FROM sys.dm_server_audit_status
If no records are returned, this is a finding.

Run this TSQL command to determine if SQL Auditing AuditActionGroups are configured:

SELECT DISTINCT sd.audit_action_name
FROM sys.server_audit_specification_details sd
JOIN sys.server_audit_specifications s
ON s.server_specification_id = sd.server_specification_id
WHERE s.is_state_enabled = 1
AND sd.audit_action_name = 'SUCCESSFUL_LOGIN_GROUP'

If no values exist for AuditActionGroup, this is a finding.

Check Content Reference

M

Target Key

5711